This appendix collects the artefacts that the chapters introduce, in the order of the chapters, so that a complete scenario record, rules-of-engagement manifest, mandate, coverage record or evidence manifest can be read in one place. Where a chapter shows an artefact in full the block is copied from it without change. Two artefacts that the chapters describe in prose or only in part, the finding record with its five states and the consent and notice protocol of Nordvik Region, are completed here from values given in the chapters and in the ledger of the two organisations, and each says so.
All of these artefacts are illustrative. The organisations, identifiers, dates and figures are fictional and are provided for teaching; they are not a record of any real system or person. Identifiers agree across the blocks: a scenario named in an emulation plan is the scenario of the record, and the finding named in a regression case is the finding of the change record.
The appendix contains no attack tooling. Its blocks are records, manifests, policies, registers, charters and reporting pages, and none contains exploit code, malware, payloads, evasion methods or step-by-step intrusion instructions. Techniques are named by identifier from MITRE ATT&CK and ATLAS and described at the level needed to design a test, a detection or a decision.
Primary topics explored
- About this appendix
- How to use this appendix
- Chapter 1: Introduction
- Chapter 2: What the Loop Did Before
- Chapter 3: The Pressure on the Loop
- Chapter 4: The Purple Loop Defined
About AI Purple
AI Purple is Book 9 of The Transformed Architecture. It takes the loop between the red team and the blue team as its subject and asks what happens when AI sits on both sides of the table: the five stages of the loop (target, emulate, observe, improve, verify), rules of engagement and safe emulation, continuous emulation, the independence principle, coverage as a claim that needs evidence, the loop's own AI and how to defend it, operating models, decision rights, regulation, and the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect, AI Boss and AI Blue.
Chief information security officers, heads of security operations, red-team leads, penetration testers, SOC managers, detection engineers, purple-team coordinators and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Appendix A: Appendix A: Code Examples: Scenario, Mandate, Coverage, Regression and Evidence Artefacts in AI Purple gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Appendices” and is one of 33 drawn from the manuscript.